update id_token when a new Access Token is fetched #2189

tusharpandey13 · 2025-06-23T10:18:26Z

This change makes the access token methods, getAccessToken and handleAccessToken also update the ID token claims present in session.user when a new Access Token is retrieved. beofreSessionSaved hook is called before session data is updated.

Changes

getTokenSet now also returns updated id_token claims information in the case of a token update using the refresh token.
both getAccessToken and handleAccessToken now handle the updated user object.
Added finalizeSession method that calls beforeSessionSaved hook if present (for custom filtering of id_token claims) else filters the id_token claims using default filtering rules.
Added flow tests for the same, mocking http layer with msw.
Added relevant docstrings.

Tests

Unit tests are PASS.
Manual testing was done on a sample app and existing issue was not reproducible.

…tered) in the case of a token update using the refresh token

src/server/client.ts

src/server/auth-client.ts

…okenSetsChanged from getTokenSet

codecov-commenter · 2025-06-23T17:11:02Z

Codecov Report

Attention: Patch coverage is 92.45283% with 4 lines in your changes missing coverage. Please review.

Project coverage is 83.07%. Comparing base (061a7a0) to head (e8ac4a8).

Files with missing lines	Patch %	Lines
src/server/auth-client.ts	90.69%	3 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2189      +/-   ##
==========================================
+ Coverage   82.91%   83.07%   +0.16%     
==========================================
  Files          21       21              
  Lines        2095     2127      +32     
  Branches      372      373       +1     
==========================================
+ Hits         1737     1767      +30     
- Misses        351      353       +2     
  Partials        7        7

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

tusharpandey13 · 2025-06-23T17:14:52Z

src/server/auth-client.test.ts

authClient.getTokenSet now returns {tokenset, user}
hence updated test

tusharpandey13 · 2025-06-23T17:16:23Z

src/server/auth-client.ts

+      let finalSession = session;
+      if (user) {
+        finalSession.user = user!;
+      }
+      if (this.beforeSessionSaved) {
+        const updatedSession = await this.beforeSessionSaved(
+          finalSession,
+          updatedTokenSet.idToken ?? null
+        );
+        finalSession = {
+          ...updatedSession,
+          internal: finalSession.internal
+        };
+      } else {
+        finalSession.user = filterDefaultIdTokenClaims(finalSession.user);
+      }
+


If idToken has updated (RT flow), update the new claims in the session.

Call beforeSessionSaved hook if available, else filter claims using default rules.

tusharpandey13 · 2025-06-23T17:17:33Z

src/server/auth-client.ts

@@ -771,6 +794,7 @@ export class AuthClient {
          ];
        }

+        const idTokenClaims = oauth.getValidatedIdTokenClaims(oauthRes)!;


Since oauthRes: oauth.TokenEndpointResponse is available here, parse the id_token claims here.

tusharpandey13 · 2025-06-23T17:19:42Z

src/server/auth-client.ts

getTokenSet now returns tokenSet and parsed user object from id_token claims on success.

handleAccessToken updated to set session if user is avaialble from getTokenSet

A new method, finalizeSession was added that calls beforeSessionSaved hook if supplied else fitlers the ID token claims in session.user using the default filtering rules.

tusharpandey13 · 2025-06-23T17:20:56Z

src/server/client.ts

getAccessToken changed similar to handleAccessToken above.

tusharpandey13 · 2025-06-23T17:22:06Z

src/server/get-access-token.test.ts

Generate id token for intial and updated scenarios

Check that updated id_token claim information is being saved to session in session.user.

guabu

The overall approach is in the right direction — left a few small comments mostly around organization.

src/server/auth-client.ts

src/server/client.ts

src/server/auth-client.ts

…uth0/nextjs-auth0 into feature/handle-idtoken-refresh

tusharpandey13 · 2025-06-24T11:29:41Z

src/server/auth-client.ts

+  async finalizeSession(
+    session: SessionData,
+    idToken?: string
+  ): Promise<SessionData> {
+    if (this.beforeSessionSaved) {
+      const updatedSession = await this.beforeSessionSaved(
+        session,
+        idToken ?? null
+      );
+      session = {
+        ...updatedSession,
+        internal: session.internal
+      };
+    } else {
+      session.user = filterDefaultIdTokenClaims(session.user);
+    }
+    return session;
+  }


finalizeSession was added that calls beforeSessionSaved hook if supplied else fitlers the ID token claims in session.user using the default filtering rules.

This logic was duplicated at 3 places so moved this to a seperate method. Also, moving to a method was necessary to remove this logic from client.ts

src/server/auth-client.ts

…tion operator

…uth0/nextjs-auth0 into feature/handle-idtoken-refresh

…]: any }

getTokenSet now also returns updated id_token claims information (fil…

9a404eb

…tered) in the case of a token update using the refresh token

tusharpandey13 requested a review from a team as a code owner June 23, 2025 10:18

tusharpandey13 changed the title ~~getTokenSet now also returns updated id_token claims information (filtered) in the case of a token update using the refresh token~~ update id_token when a new Access Token is fetched Jun 23, 2025

frederikprijck reviewed Jun 23, 2025

View reviewed changes

src/server/client.ts Outdated Show resolved Hide resolved

src/server/auth-client.ts Outdated Show resolved Hide resolved

src/server/auth-client.ts Outdated Show resolved Hide resolved

tusharpandey13 added 3 commits June 23, 2025 17:29

add beforeSessionSaved hook call to access token methods; return hasT…

ef2f1a8

…okenSetsChanged from getTokenSet

make claims filtering conditional based on beforeSessionSaved hook

85d782f

revert to old style of checking if token has updated

150aee2

tusharpandey13 requested a review from frederikprijck June 23, 2025 14:49

update tests to include the updated id_token and session.user scenario

ca45b93

Merge branch 'main' into feature/handle-idtoken-refresh

30b1099

tusharpandey13 commented Jun 23, 2025

View reviewed changes

src/server/auth-client.test.ts Outdated

Copy link

Contributor Author

tusharpandey13 Jun 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

authClient.getTokenSet now returns {tokenset, user}
hence updated test

tusharpandey13 commented Jun 23, 2025

View reviewed changes

src/server/client.ts

Copy link

Contributor Author

tusharpandey13 Jun 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

getAccessToken changed similar to handleAccessToken above.

tusharpandey13 commented Jun 23, 2025

View reviewed changes

guabu suggested changes Jun 24, 2025

View reviewed changes

src/server/auth-client.ts Outdated Show resolved Hide resolved

src/server/client.ts Outdated Show resolved Hide resolved

src/server/client.ts Outdated Show resolved Hide resolved

guabu reviewed Jun 24, 2025

View reviewed changes

src/server/auth-client.ts Show resolved Hide resolved

tusharpandey13 added 2 commits June 24, 2025 16:54

move beforeSessionSave logic to auth-client, add doc

add285e

Merge branch 'feature/handle-idtoken-refresh' of https://github.com/a…

67d36df

…uth0/nextjs-auth0 into feature/handle-idtoken-refresh

tusharpandey13 commented Jun 24, 2025

View reviewed changes

Merge branch 'main' into feature/handle-idtoken-refresh

fb50abb

guabu reviewed Jun 24, 2025

View reviewed changes

src/server/auth-client.ts Outdated Show resolved Hide resolved

src/server/auth-client.ts Outdated Show resolved Hide resolved

src/server/auth-client.ts Outdated Show resolved Hide resolved

src/server/auth-client.ts Outdated Show resolved Hide resolved

tusharpandey13 added 3 commits June 25, 2025 10:40

trim redundant info in docstrings; remove un-necessary non-null asser…

8828596

…tion operator

Merge branch 'feature/handle-idtoken-refresh' of https://github.com/a…

734aa1f

…uth0/nextjs-auth0 into feature/handle-idtoken-refresh

change type of idTokenClaims in GetTokenSetResponse to { [key: string…

e8ac4a8

…]: any }

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

update id_token when a new Access Token is fetched #2189

update id_token when a new Access Token is fetched #2189

Uh oh!

tusharpandey13 commented Jun 23, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov-commenter commented Jun 23, 2025 •

edited

Loading

Uh oh!

tusharpandey13 Jun 23, 2025

Uh oh!

tusharpandey13 Jun 23, 2025

Uh oh!

tusharpandey13 Jun 23, 2025

Uh oh!

tusharpandey13 Jun 23, 2025 •

edited

Loading

Uh oh!

tusharpandey13 Jun 23, 2025

Uh oh!

tusharpandey13 Jun 23, 2025

Uh oh!

guabu left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tusharpandey13 Jun 24, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

update id_token when a new Access Token is fetched #2189

Are you sure you want to change the base?

update id_token when a new Access Token is fetched #2189

Uh oh!

Conversation

tusharpandey13 commented Jun 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Tests

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov-commenter commented Jun 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

tusharpandey13 Jun 23, 2025

Choose a reason for hiding this comment

Uh oh!

tusharpandey13 Jun 23, 2025

Choose a reason for hiding this comment

Uh oh!

tusharpandey13 Jun 23, 2025

Choose a reason for hiding this comment

Uh oh!

tusharpandey13 Jun 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tusharpandey13 Jun 23, 2025

Choose a reason for hiding this comment

Uh oh!

tusharpandey13 Jun 23, 2025

Choose a reason for hiding this comment

Uh oh!

guabu left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tusharpandey13 Jun 24, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tusharpandey13 commented Jun 23, 2025 •

edited

Loading

codecov-commenter commented Jun 23, 2025 •

edited

Loading

tusharpandey13 Jun 23, 2025 •

edited

Loading

guabu left a comment •

edited

Loading